Skip to content

[BUG]: Auto-fix for template-injection overcorrects on env.FOO fixes #1052

Closed

Description

@woodruffw

Pre-submission checks

  • I am not filing a feature request. These should be filed via the feature request form instead.
  • I have looked through the open issues for a duplicate report.

zizmor version

1.11.0

Expected behavior

Here's a pretty common pattern we currently flag:

run: echo ${{ env.FOO }}
env:
  FOO: blah blah

This should be auto-fixed as:

run: echo ${FOO}
env:
  FOO: blah blah

Actual behavior

Instead, we overcorrect by replacing the original FOO: value with its ${{ env.FOO }} expansion, which results in an empty expansion (unless the user has FOO set somewhere higher up):

run: echo ${FOO}
env:
  FOO: ${{ env.FOO }}

The trick here is probably to special-case the env. context namespace and not perform an env: block insertion in that case.

Reproduction steps

See above.

Logs

N/A

Additional context

No response

Activity

  1. added
    bugSomething isn't working
    autofixAuto-fix functionality
    on Aug 1, 2025
  2. added a commit that references this issue on Aug 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    autofixAuto-fix functionalitybugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions